> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hexr.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Helm Configuration

> Complete reference for Hexr Helm chart configuration values.

## Chart Structure

The Hexr Helm chart is a umbrella chart with subcharts:

```
hexr-runtime/
├── Chart.yaml
├── values.yaml
├── values-saas.yaml          # Hexr Cloud overrides
├── templates/
│   ├── auto-registrar/
│   ├── cred-injector/
│   ├── dashboard/
│   ├── gateway/
│   ├── vault/
│   ├── sandbox/
│   ├── otel-collector/
│   └── valkey/
└── charts/
    ├── spire/                # SPIRE subchart
    └── cloud-api/            # Cloud API subchart
```

***

## Key Values

### Global

| Value                | Default                                                  | Description         |
| -------------------- | -------------------------------------------------------- | ------------------- |
| `global.trustDomain` | `demo.hexr.dev`                                          | SPIFFE trust domain |
| `global.registry`    | `us-central1-docker.pkg.dev/hexr-cloud-prod/hexr-images` | Container registry  |
| `global.namespace`   | `hexr-system`                                            | Platform namespace  |

### SPIRE

| Value                      | Default                         | Description                             |
| -------------------------- | ------------------------------- | --------------------------------------- |
| `spire.server.trustDomain` | `demo.hexr.dev`                 | Trust domain                            |
| `spire.server.ca.ttl`      | `24h`                           | CA certificate TTL                      |
| `spire.agent.socketPath`   | `/run/spire/sockets/agent.sock` | Workload API socket                     |
| `spire.oidc.enabled`       | `false`                         | Enable OIDC Discovery provider          |
| `spire.oidc.hostname`      | —                               | OIDC hostname (e.g., `oidc.hexr.cloud`) |

### Auto-Registrar

| Value                           | Default  | Description                       |
| ------------------------------- | -------- | --------------------------------- |
| `autoRegistrar.image.tag`       | `v0.2.2` | Image tag                         |
| `autoRegistrar.watchNamespaces` | `""`     | Namespaces to watch (empty = all) |
| `autoRegistrar.logLevel`        | `info`   | Log level                         |

### Credential Injector

| Value                                             | Default  | Description            |
| ------------------------------------------------- | -------- | ---------------------- |
| `credentialInjector.image.tag`                    | `v0.4.2` | Image tag              |
| `credentialInjector.aws.roleArn`                  | —        | AWS IAM role ARN       |
| `credentialInjector.gcp.workloadIdentityProvider` | —        | GCP WIF provider       |
| `credentialInjector.azure.tenantId`               | —        | Azure AD tenant ID     |
| `credentialInjector.cache.l1TTL`                  | `900`    | L1 cache TTL (seconds) |
| `credentialInjector.cache.l2TTL`                  | `3600`   | L2 cache TTL (seconds) |

### Vault

| Value                            | Default  | Description                  |
| -------------------------------- | -------- | ---------------------------- |
| `hexr-vault.vault.image.tag`     | `v0.1.1` | Image tag                    |
| `hexr-vault.vault.postgres.url`  | —        | PostgreSQL connection string |
| `hexr-vault.vault.encryptionKey` | —        | AES-256 master key           |

### Gateway

| Value                    | Default  | Description                    |
| ------------------------ | -------- | ------------------------------ |
| `gateway.image.tag`      | `v0.4.1` | Image tag                      |
| `gateway.maxToolTimeout` | `30s`    | Maximum tool execution timeout |

### Dashboard

| Value                       | Default   | Description        |
| --------------------------- | --------- | ------------------ |
| `dashboard.image.tag`       | `v0.3.11` | Image tag          |
| `dashboard.ingress.enabled` | `false`   | Enable Ingress     |
| `dashboard.ingress.host`    | —         | Dashboard hostname |

### Observability

| Value                   | Default | Description           |
| ----------------------- | ------- | --------------------- |
| `otelCollector.enabled` | `true`  | Enable OTel Collector |
| `prometheus.enabled`    | `true`  | Enable Prometheus     |
| `grafana.enabled`       | `true`  | Enable Grafana        |

***

## Upgrade Command

```bash theme={null}
DB_PASS=$(gcloud secrets versions access latest --secret=hexr-db-password --project=hexr-cloud-prod)

helm upgrade hexr-runtime . -n hexr-system \
  -f values-saas.yaml \
  --set attestor.database.postgres.external.password="$DB_PASS" \
  --set "hexr-vault.vault.postgres.url=postgresql://hexr:${DB_PASS}@10.60.0.3:5432/hexr_vault?sslmode=disable" \
  --set "cloud-api.cloudApi.database.url=postgresql://hexr:${DB_PASS}@10.60.0.3:5432/hexr_metering?sslmode=disable" \
  --server-side=false --timeout 10m
```

<Warning>
  Always use `-f values-saas.yaml` with `--set` for secrets. Never use `--reuse-values`.
</Warning>